Authentication: How SMEs protect their network and data with 2FA and MFA

Remote access from outside represents a gap in the security arrangements of many SMEs in Switzerland. An ever-increasing number of employees working from home, freelancers, IT service providers and suppliers are accessing the company network, web applications, business-critical programs and sensitive data. A password alone is no longer enough to securely protect and control access. No matter how good it is. With two-factor authentication (2FA) or multi-factor authentication (MFA), small and medium-sized enterprises can greatly improve the security of their data and systems with comparatively little effort.

 Each login process can be divided into three steps: 

1. Log in: The user identifies himself/herself with their username and password and logs in – identification.
2. Check: The system checks all the user's details and compares them with the entries in the database – authentication.
3. Authorize: The system releases access if the information is correct and grants the user role-based rights – authorization.

With two-factor authentication, the user must authenticate themselves with two factors. Usually with their password and another factor. This can be a code, for example, which the system sends to the registered smartphone by text message after the password has been entered correctly. Other factors may include an authenticator app, fingerprint, a USB token, a smart card or a client certificate on their laptop.

With multi-factor authentication, the user must identify themselves with at least two factors according to this principle:

• Something that only the user knows, for example their personal password
• Something that only the user possesses, such as their smartphone or USB token
• Something that only the user embodies, for example their fingerprint (Touch ID) or their face (Face ID)

Regardless of whether access is protected with 2FA or MFA: The system will not allow access until all factors have been correctly authenticated.

• Security: 2FA and MFA significantly reduce the risk of unauthorized access and data breaches, as cybercriminals have to pick at least two locks. Even if they find out the password through phishing, they cannot access the system or the data because they do not have the smartphone or fingerprint, for example.
• Compliance: More and more industries have to comply with strict security standards such as strong authentication measures. Companies that meet these requirements avoid legal consequences and, at the same time, strengthen the trust of customers and partners.
• Costs: With the introduction of 2FA or MFA for all user accounts, SMEs avoid losses, costly business interruptions, and expensive system and data recovery measures as well as unquantifiable reputational damage that could even jeopardize their existence.

The MFA or 2FA rollout must be carefully planned and executed to seamlessly integrate authentication and effectively protect the corporate network. SMEs that have no or too few IT resources are best advised to commission specialists. For example, your IT service supplier for remote access to the company network or your web host or a programmer for access to the online store. It makes sense to protect the following access points with MFA or 2FA:

• Remote access to sensitive and business-critical company data, such as emails
•  Access to the intranet via the Virtual Private Network (VPN)
• Access to web or cloud solutions or applications
• Access to Infrastructure-as-a-Service (IaaS) and Software-as-a-Service (SaaS) components 
• Network components and control systems that are connected to the Internet

MFA or 2FA should be implemented for the entire company, not just for employees. This means end-to-end provision for all users: From employees to management, IT staff and administrators through to external employees and service suppliers. Only then will the IT infrastructure and business-critical data be truly secure and protected. In principle, there should be no exceptions and multi-factor authentication should be enforced for all users and remote access. Justified exceptions to this rule should be documented and limited in time. All employees should be trained accordingly during the 2FA/MFA introduction and know how the entry of the second and possibly third factor works and in which situations these factors are queried.

For SMEs we offer security checks and security assessments that reveal vulnerabilities such as a lack of 2FA or MFA. Such security gaps must be closed immediately: by the SME's security officer, by the IT department or by an external IT service supplier if support is outsourced. Zurich Resilience Solutions carries out 60,000 fee-based risk assessments every year. For SMEs, among others, who want to know how secure their IT infrastructure, business-critical applications and sensitive data are.

• Cyber insurance for SMEs in Switzerland
• A hacker attack threatens a company's existence
• IT contingency plan: How SMEs can protect themselves
• Plan B: Business continuity plan for SMEs
• National Cyber Security Centre NCSC: Start page
  
• National Cyber Security Centre NCSC: S-U-P-E-R.ch - Secure your access twice
• Microsoft: Setting up multi-factor authentication for Microsoft 365